From Chapter 3, Jaquith writes that some metrics, such as Top 10 lists, are useless because they don’t pass the “so what?” test, and relays a quotation from Reed Harrison: “The typical ‘Top 10 Ports’, ‘Top 10 Attacking IP Addresses,’ and ‘Top 10 URLs’ are really just watch lists. Our customers don’t consider them compelling metrics; they prefer to measure operational efficiency and the effectiveness of their control environment.”